PT-2020-6686 · Apache +2 · Apache Airflow +2

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 1.10.10 and below Description: The issue is related to the deserialization of untrusted data in Apache Airflow, which can lead to remote code execution. An attacker, acting remotely, can exploit this issue by inserting...

PT-2020-6688 · Apache +2 · Apache Airflow +2

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 1.10.10 and below Description: The issue allows an attacker to inject commands if they can connect directly to the broker, such as Redis or RabbitMQ, when using CeleryExecutor. This can result in the celery worker...

DEBIAN-CVE-2020-6582

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call...

mesos: docker image code execution

A flaw was found in Docker image running under root user, where it is possible to overwrite the init helper binary of the container runtime or the command executor in Apache Mesos. A malicious user could use this flaw to gain root-level code execution on the host...

CVE-2019-0204

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain...

CVE-2019-0204: Undefined Security Weakness

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0, <=2.0.1) potentially affected by CVE-2017-12625 via org.apache.hive:hive (2.1.1)

org.apache.hive:hive MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2017-12625 Source advisory: GHSA-2G9Q-CHQ2-W...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0, <=2.0.1) potentially affected by CVE-2017-12625 via org.apache.hive:hive (2.1.1)

org.apache.hive:hive MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2017-12625 Source advisory:...

com.dangdang:elastic-job-cloud-executor (>=2.0.3, <=2.1.1), com.dangdang:elastic-job-cloud-scheduler (>=2.0.3, <=2.1.1) +17 more potentially affected by CVE-2018-11793 via org.apache.mesos:mesos (0.28.2)

org.apache.mesos:mesos MAVEN version 0.28.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.dangdang:elastic-job-cloud-executor =2.0.3, =2.0.3, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0,...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0, <=2.0.1) potentially affected by CVE-2018-1284 via org.apache.hive:hive (2.1.1)

org.apache.hive:hive MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2018-1284 Source advisory:...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0, <=2.0.1) potentially affected by CVE-2018-1284 via org.apache.hive:hive (2.1.1)

org.apache.hive:hive MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2018-1284 Source advisory: GHSA-RXMR-C9JM-7M...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0, <=2.0.1) potentially affected by CVE-2018-1315 via org.apache.hive:hive (2.1.1)

org.apache.hive:hive MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2018-1315 Source advisory:...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0, <=2.0.1) potentially affected by CVE-2018-1315 via org.apache.hive:hive (2.1.1)

org.apache.hive:hive MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2018-1315 Source advisory: GHSA-P639-XXV5-J3...

PYSEC-2018-92

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh privatekeyfilename can take an absolute path, it can be used to...

PYSEC-2018-92

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh privatekeyfilename can take an absolute path, it can be used to...

DEBIAN-CVE-2018-16849

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh privatekeyfilename can take an absolute path, it can be used to...

PT-2018-13771 · Openstack +1 · Openstack-Mistral +1

Name of the Vulnerable Software and Affected Versions: openstack-mistral affected versions not specified Description: A flaw in openstack-mistral allows the disclosure of the presence of arbitrary files within the filesystem of the executor running the action. This is achieved by manipulating the...

CVE-2018-8023

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token JWT. In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timi...

CVE-2018-8023: Exposure of Sensitive Information to an Unauthorized Actor

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token JWT. In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timi...

Unsupervised Coverage-Guided Kernel Fuzzer: syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer. Linux kernel fuzzing has the most support, akaros, freebsd, fuchsia, netbsd and windows are supported to varying degrees. Initially, syzkaller was developed with Linux kernel fuzzing in mind, but now it’s being extended to support other ...